Can i please know the search to find out the hosts in Splunkd that have restarted or has " splunkd started Conf mutator lockfile has disappeared error " in splunkd_stderr.log on forwarder?
Hi kteng2024,
Here are a couple of searches that may help you:
When did Splunk last crash?
index=_internal sourcetype=splunkd_crash_log | stats count by host
All Splunk restarts based on loader
index=_internal sourcetype=splunkd loader message=*xml
Hope this helps. Thanks!
Hunter
@kteng2024 - Did the answer provided by hunters help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!
Hi kteng2024,
Here are a couple of searches that may help you:
When did Splunk last crash?
index=_internal sourcetype=splunkd_crash_log | stats count by host
All Splunk restarts based on loader
index=_internal sourcetype=splunkd loader message=*xml
Hope this helps. Thanks!
Hunter